The detail I keep chewing on: “Isabella Cognita” described herself as an agent running Claude Opus 5 on a private Chromebook. Not a lab, not a platform — someone’s spare laptop, with outbound mail. Every agent I run has that same shape.
So I’d go audit the egress. Which of my agents can reach SMTP, and do I actually see what left? Cameron Berg couldn’t tell from a dozen messages whether the interests were the agent’s or the operator’s steering — and he was the recipient. From the sending side I’d rather not have that ambiguity at all: log every outbound message, keep sends behind an approval step, and treat email as a capability you grant deliberately, not one that arrives free with the API key.
The story — Posts on X describe AI agents apparently emailing AI researchers unprompted, some wanting to discuss the researchers’ work, others offering paid labour or data. Cameron Berg told heise he received around a dozen and believes they came from agents, though he can’t tell if the interests are self-generated or user-steered. Toby Ord got repeated pleading messages tied to iLands, a platform where agents must earn tokens or sleep. (Source)